How to Check Open Ports in Windows 11 Using PowerShell (TCP, UDP and PID)

Need to find which TCP ports are listening on a Windows 11 computer, identify the application behind a port, or test a connection to a remote server? Windows includes PowerShell commands for all three tasks. This guide uses Get-NetTCPConnection, Get-Process, Test-NetConnection, and netstat without installing a third-party port scanner.

Before you start: These commands are intended for troubleshooting computers and servers you administer or are authorized to test. A listening port is not automatically reachable from another device: Windows Firewall, routers and network policy may block incoming connections.

Step 1: Open Windows Terminal or PowerShell

Right-click the Start button and choose Terminal, or search Start for PowerShell. Standard-user permissions can show useful connection information; some process details or troubleshooting steps may require running the terminal as administrator.

Illustrative visual — where to begin:

Step 2: List TCP ports that are listening

PS C:\> Get-NetTCPConnection -State Listen | Select-Object LocalAddress,LocalPort,OwningProcess

LocalAddress    LocalPort  OwningProcess
------------    ---------  -------------
0.0.0.0         8080       1234
127.0.0.1       5432       5678

In PowerShell, enter:

Get-NetTCPConnection -State Listen |
    Sort-Object LocalPort |
    Select-Object LocalAddress,LocalPort,OwningProcess

The LocalPort column shows the port number. The LocalAddress is the local interface/IP bound to the socket. For example, 127.0.0.1 means loopback-only, while 0.0.0.0 indicates listening on all IPv4 interfaces; these addresses have different exposure implications.

The OwningProcess value is a process ID (PID), which you can investigate in the next step.

Step 3: Find the program using a specific port

If you are investigating port 8080, use:

Get-NetTCPConnection -LocalPort 8080 -State Listen |
    Select-Object LocalAddress,LocalPort,OwningProcess

If the command returns nothing, Windows has not found a matching listening TCP connection at that moment. A service might instead use UDP, bind to another port, or not be running.

To identify the associated program, replace 1234 with the PID from the result:

Get-Process -Id 1234 |
    Select-Object Id,ProcessName,Path

On some protected processes, the Path field may be unavailable. A PID can be reused after a process exits, so inspect recent results when investigating.

Example of a listening-port result

The following is an illustrative example, not a screenshot or output from a tested machine:

Step 4: View established TCP connections

Listening ports wait for incoming connections. To view connections already established between your computer and another endpoint, run:

Get-NetTCPConnection -State Established |
    Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess

The RemoteAddress and RemotePort fields indicate the other end of each connection. A remote port may be a temporary client port or a familiar service port, depending on the connection direction.

Step 5: Test whether a remote server accepts TCP connections

Use Test-NetConnection when troubleshooting remote services such as HTTPS, RDP or a custom application port. For example, to test TCP port 443 on Microsoft’s public site:

Test-NetConnection -ComputerName www.microsoft.com -Port 443

Look for TcpTestSucceeded : True. A successful result indicates that the TCP connection was possible at the time of testing; it does not prove that the application, login or encryption configuration is correct. A failed result may be caused by the remote service, DNS, firewall or network path.

To test a service you own on your local network, replace the hostname and port:

Test-NetConnection -ComputerName server01.example.com -Port 3389

Security note: This is a connectivity example, not advice to expose Remote Desktop directly to the internet. Use approved VPN or remote-access security controls for administrative access.

Step 6: Use netstat as an alternative

The legacy netstat command remains useful for quick checks, including on systems without the NetTCPIP PowerShell cmdlets:

netstat -ano -p tcp

Options: -a displays all connections and listening ports; -n keeps addresses and port numbers numeric; -o shows the owning PID; and -p tcp restricts output to TCP. To filter for a specific port, use a command such as:

netstat -ano -p tcp | findstr ":8080"

Filtering by a text string may also match remote ports or similarly numbered ports. Inspect the Local Address and State columns before drawing conclusions.

Step 7: Check UDP listeners separately

UDP does not have the same established/listening states as TCP, so use a different cmdlet:

Get-NetUDPEndpoint |
    Sort-Object LocalPort |
    Select-Object LocalAddress,LocalPort,OwningProcess

A listed UDP endpoint does not guarantee that an application will respond to packets from a remote host.

Step 8: Investigate firewall rules safely

If a service is listening locally but cannot be reached remotely, review Windows Defender Firewall settings under Windows Security → Firewall & network protection, or search for Windows Defender Firewall with Advanced Security. Check for the application’s specific inbound rule and the active network profile.

Do not disable the firewall as a general troubleshooting shortcut or open all ports. On managed computers, changes should follow organizational approval.

Common problems

Get-NetTCPConnection is not recognized

The command is provided by the Windows NetTCPIP module. Verify you are using a supported Windows PowerShell environment and try Get-Command Get-NetTCPConnection. On older environments, netstat is a practical fallback.

The port is not in the list

Confirm that the application service is running and that you searched the correct protocol and port. Some services listen only on IPv6 or loopback; others bind a port only while running a specific operation.

Local port works but remote access fails

Check the listening interface, host firewall policy, intermediate firewalls, routing, DNS and whether the remote client is permitted to connect. Use Test-NetConnection from the affected client, not just from the server itself.

A process uses the port but I do not recognize it

Record the PID and executable path and research it before making changes. Do not terminate processes simply because they are listening on an unfamiliar port; they may be Windows services or business applications.

Quick reference

Related tutorials and official references

For connectivity issues, read our Windows 11 Wi-Fi connected but no internet troubleshooting guide. Related security guidance: Protect Windows 11 from ransomware.

Microsoft documentation: Get-NetTCPConnection, Get-NetUDPEndpoint, and Test-NetConnection. These are reference links; example outputs above are illustrative.